In today’s increasingly interconnected financial ecosystem, cybersecurity has become a fundamental pillar of operational resilience. High-Frequency Trading (HFT), where trading decisions and executions occur within milliseconds, depends on the continuous availability, integrity, and confidentiality of critical systems. While speed and performance remain essential competitive advantages, they also expand the attack surface, making HFT platforms attractive targets for sophisticated cyber threats. 

As financial markets continue to evolve, ensuring that trading infrastructures remain secure without compromising performance is no longer optional, it is a strategic necessity. This challenge is at the heart of the CyberAId project, where JRC Capital contributes to the development and validation of innovative cyber-resilience solutions designed specifically for high-performance trading environments. 

Addressing the Cybersecurity Challenges of High-Frequency Trading 

Every second, high-frequency trading platforms process enormous volumes of market data, execute thousands of trades, and rely on proprietary algorithms that represent years of expertise and significant competitive value. A single disruption, unauthorized access, or manipulated data feed can quickly lead to financial losses and operational disruption. 

Protecting these highly complex environments means addressing several challenges at once. Trading algorithms must be safeguarded against theft and unauthorized access, while real-time market data needs to remain accurate, authentic, and free from manipulation. Communications between trading environments and connected platforms must be secure. At the same time, all of this has to happen without introducing the slightest delay that could affect trading performance. 

Meeting these challenges requires far more than traditional cybersecurity measures. It demands continuous monitoring, intelligent threat detection, automated risk assessment, and rapid incident response working together to keep critical systems secure while allowing trading operations to perform at their highest level. 

CyberAId: Building Smarter Cyber Resilience for Financial Markets 

The CyberAId project aims to strengthen cyber resilience through advanced threat detection and dynamic risk modelling, enabling organizations to anticipate, detect, and respond to cyber threats before they impact critical operations. 

 JRC Capital participates in the High-Frequency Trading pilot, which serves as a real-world environment for validating innovative cybersecurity capabilities tailored to financial services. The pilot demonstrates how artificial intelligence, continuous monitoring, and automated response mechanisms can enhance the protection of trading infrastructures while preserving the ultra-low latency required by modern trading systems. 

 The pilot focuses on three complementary use cases that address critical aspects of cybersecurity within high-frequency trading environments. 

 UC4.1 Protecting Trading Algorithm Intellectual Property 

 Proprietary trading algorithms represent one of the most valuable assets of any trading institution. These algorithms encapsulate years of research, market expertise, and strategic innovation, making them prime targets for cyber espionage and intellectual property theft. 

The CyberAId pilot explores mechanisms for strengthening the protection of algorithmic assets by continuously monitoring access patterns, identifying anomalous behaviour, and supporting the early detection of potential insider threats or unauthorized activities. By enhancing visibility into algorithm access and execution environments, the pilot contributes to safeguarding one of the JRC’s most strategic resources. 

 UC4.2 Monitoring the Integrity of Market Data Feeds 

 High-frequency trading decisions depend entirely on accurate and trustworthy market data. Even minor manipulation, corruption, or delays in data feeds can influence trading strategies, create market exposure, and introduce operational risks. 

To address this challenge, the CyberAId pilot evaluates intelligent monitoring techniques capable of identifying anomalies in real-time market data streams. Continuous integrity verification enables the rapid detection of suspicious deviations, helping ensure that trading decisions are based on reliable and authentic information while supporting uninterrupted trading operations. 

 UC4.3 Automating Regulatory Incident Response 

 Financial institutions operate within a highly regulated environment where cybersecurity incidents require timely investigation, documentation, and reporting. Manual response processes can delay decision-making and increase operational burden during critical situations. 

 The CyberAId pilot investigates automated incident response capabilities that support security teams by streamlining detection, prioritization, and reporting workflows. By integrating cyber threat intelligence with risk modelling, the platform facilitates faster and more consistent responses while helping organizations meet regulatory expectations and strengthen operational resilience. 

Balancing Security and Performance 

One of the defining characteristics of high-frequency trading is the requirement for extremely low latency. Any additional security mechanism must operate without introducing measurable delays that could affect trading competitiveness. 

 For this reason, the CyberAId pilot emphasizes security solutions that complement existing trading infrastructures while minimizing performance overhead. Intelligent monitoring, adaptive risk assessment, and automated response mechanisms are designed to operate seamlessly alongside trading operations, allowing cybersecurity and business performance to coexist rather than compete. This balance between resilience and efficiency represents a critical step toward building secure financial systems capable of withstanding increasingly sophisticated cyber threats. 

 Looking Forward 

 As cyber threats targeting financial markets continue to evolve, resilience must become an integral component of every trading platform. Advanced threat detection, dynamic risk modelling, and intelligent automation will play an increasingly important role in protecting critical financial infrastructures and maintaining trust in global markets. 

 Through its participation in the CyberAId project, JRC Capital is contributing to the development of next-generation cybersecurity solutions that address the unique demands of high-frequency trading. By combining innovation, operational expertise, and collaborative research, the project demonstrates how financial institutions can strengthen cyber resilience while preserving the speed, reliability, and performance that modern markets require. 

Ultimately, building resilient trading environments is not only about protecting technology, it is about safeguarding market integrity, maintaining investor confidence, and ensuring the secure evolution of digital finance. 

 

Financial institutions are among the most critical pillars of Europe's digital economy. Every day, banks process high volumes of transactions, protect sensitive customer data, and operate digital services that must remain available, trustworthy, and resilient. At the same time, the cyber threat landscape is becoming more sophisticated, with adversaries increasingly leveraging automation, artificial intelligence, and advanced evasion techniques. In this context, digital defense can no longer rely on isolated tools or reactive processes. It requires integrated, intelligent, and collaborative approaches capable of anticipating, detecting, and responding to threats at scale. 

 Against this backdrop, initiatives like CyberAId offer a practical opportunity to bring next-generation, AI-driven security mechanisms out of the research lab and into the operational reality of the banking sector. The goal is to ensure that these emerging technologies are not designed in a vacuum, but rather validated against the complex constraints, regulatory demands, and daily operations of a highly regulated environment. Ultimately, AI is not a standalone silver bullet, its true value lies in its ability to enrich security data with deep contextual intelligence supporting human analysts, drastically improving triage, and building a more coordinated defense model. 

 To achieve this, new cybersecurity tools must seamlessly align with established operational models, compliance requirements, and risk management frameworks. By engaging security teams and technical experts from day one, banks can define realistic deployment strategies to ensure AI-driven tools address actual, day-to-day challenges rather than theoretical scenarios. 

 One of the most promising applications of this technology focuses on anomaly detection and incident response. The goal is to implement integrated systems capable of neutralizing threats that target digital infrastructures and transaction environments. This approach is structured around three main pillars:  

• AI-driven context enrichment: Synthesizing information from diverse and disparate data sources to build a comprehensive, high-fidelity view of potential security events. This enriched context significantly improves threat detection accuracy and streamlines the initial triage process by distinguishing real threats from background noise. 

• Streamlined incident response: Empowering security teams through Large Language Models (LLMs) and autonomous AI agents. These intelligent agents can assist with triaging alerts, accelerating deep investigations, and executing automated countermeasures to contain threats swiftly. 

• Enterprise-wide risk visualization: Delivering a real-time, comprehensive view of the organization's overall security posture. 

 For a modern bank, integrating these capabilities into an Integrated Security Operations Center (iSOC) is paramount. The iSOC serves as the nerve center where monitoring, analysis, and response activities converge. Introducing AI into this ecosystem means augmenting human expertise with intelligent support, rather than replacing it. By automatically feeding analysts enriched contextual data, AI transforms fragmented alerts into a coherent narrative. This is crucial for managing "alert fatigue": it allows the iSOC to drastically reduce false positives so analysts don't waste time chasing ghosts while sharpening the focus on genuine, high-priority threats. Furthermore, real-time monitoring technologies grant deeper visibility into network and system behavior, driving faster detection and improved operational efficiency. 

 Beyond incident response, true cyber-resilience requires a holistic, proactive strategy. This means going a step further to incorporate measures such as AI-driven penetration testing, vulnerability assessments, privacy-preserving analytics, and secure coding practices. By unifying proactive and reactive mechanisms under an intelligent agentic orchestration layer, modern cybersecurity frameworks can tackle threats in a fully integrated, scalable manner. 

 Cybersecurity and usability are often perceived as competing objectives. The literature contains numerous examples of cybersecurity solutions that have been criticized for poor usability and user experience. Several studies highlight several conflicts between security and usability during both system design and use. From a design perspective, security is frequently treated as an afterthought and integrated late in the development process, often resulting in complex and difficult-to-use solutions. From a user perspective, security mechanisms can interrupt users’ primary tasks and workflows, whereas usability aims to support users in achieving their goals efficiently and effectively. However, rather than viewing security and usability as mutually exclusive, both are essential and should be considered jointly throughout the design process in an iterative and integrated manner.

Similarly, some studies emphasize the importance of usable cybersecurity by examining the limited visibility of security functionalities within end-user applications. Common shortcomings include security settings scattered across multiple menus and sub-menus, security-related features hidden within advanced configuration options, and interfaces that fail to clearly communicate security status or available protections. Such design issues can reduce user awareness, hinder the effective use of security features, and ultimately weaken the overall security posture of the system [1].

These findings highlight the importance of adopting user-centred approaches when designing cybersecurity solutions, ensuring that security mechanisms are not only effective but also understandable, accessible, and usable by their intended users.

CyberAId Practices: User needs & Requirements collection 

In the CyberAId project, requirements engineering and user-centred design play a central role in ensuring that the developed tools address actual cybersecurity needs within finance organisations and ensure effectives system’s usability. The CyberAId requirements engineering process follows a structured methodology that combines multiple sources of information, including:

• Financial sector cybersecurity challenges
• Pilot stakeholder needs
• Project technical objectives
• Regulatory frameworks such as DORA, NIS2, GDPR, PSD2, and the EU AI Act
• International cybersecurity standards and best practices
• Partner expertise and operational experience

By combining these perspectives, CyberAId ensures that requirements are not only technically feasible but also aligned with real-world financial-sector environments.

The requirements collected during the project are classified, reviewed, prioritised, and validated through an iterative process involving technical partners, pilot organisations, cybersecurity experts, and financial-sector stakeholders [2].

Why User stories Matter

While requirements describe what the CyberAId platform must achieve, user stories explain why specific capabilities are needed and how they deliver value to end users. They provide a user-centred perspective that helps translate technical requirements into practical functionalities aligned with real operational needs.

CyberAId adopts user stories as a means of bridging the gap between technical development and the day-to-day realities of financial-sector organizations. By capturing requirements from the perspective of the individuals who will interact with the platform, user stories help development teams better understand user goals, expectations, and challenges.

By developing structured user stories based on the needs of actual stakeholders, CyberAId ensures that the resulting solutions are not only technically robust and compliant with regulatory requirements, but also relevant, usable, and effective in addressing real-world cybersecurity challenges. This approach supports the design of solutions that enhance user experience, facilitate adoption, and ultimately contribute to stronger cybersecurity resilience across the financial sector.

Continuous Validation Through Pilot Activities

Within CyberAId, requirements and user stories are not treated as static project outputs but as living artifacts that evolve throughout the project lifecycle. As technical development progresses and pilot activities unfold, stakeholders continuously review, validate, and refine the identified requirements to ensure they remain aligned with emerging cybersecurity challenges, regulatory developments, and operational needs.

The project’s pilot environments play a crucial role in this process by providing realistic financial-sector settings in which CyberAId technologies can be evaluated and improved. Through ongoing feedback from cybersecurity professionals, operational teams, and financial-sector stakeholders, the consortium can assess whether the proposed functionalities effectively address real-world challenges related to threat detection, incident response, operational resilience, regulatory compliance, and cyber risk management.

This iterative validation approach ensures that CyberAId remains grounded in practical needs while delivering solutions that are both technically robust and operationally relevant.

Looking Ahead

The requirements baseline established in CyberAId marks the beginning of a structured journey towards a more resilient, trustworthy, and intelligent cybersecurity ecosystem for the financial sector. By translating stakeholder needs into clear requirements and user-centred functionalities, the project creates a solid foundation for the design, development, and validation of its AI-driven cybersecurity framework.

As the project advances, these requirements will continue to guide the evolution of CyberAId’s core capabilities, supporting the development of innovative solutions for proactive cyber defense, continuous monitoring, threat intelligence, incident management, and regulatory reporting.

By combining advanced cybersecurity technologies, artificial intelligence, regulatory compliance, and continuous stakeholder engagement, CyberAId aims to deliver solutions that not only strengthen the security posture of financial organizations but also enhance their operational resilience in an increasingly complex threat landscape.

References

[1] Nurse, J. R. C., Creese, S., Goldsmith, M., & Lamberts, K. (2011). Guidelines for Usable Cybersecurity: Past and Present. Proceedings of the 2011 International Conference on Cyber Security and Protection of Digital Services. Available at: https://kar.kent.ac.uk/67535/1/CSS2011_NCGL_authors_final.pdf

[2] CyberAId Consortium, D2.1 – Financial Sector Cybersecurity Requirements Analysis, Deliverable D2.1, CyberAId Project, 2026.